SandBox - Test office malicious macro

You will need to install office in the sandbox first.

You can make your own wsb config files to launch sandbox and install programs and tweak the settings at launch, Kari has made a tutorial explaining some of the options here - Windows Sandbox - How to configure in Windows 10

lco said:

Therefore, I will have to give a try to Sandboxie. Was it as secure as native sandboxing?

Thank you for your answer.

Kind regards

You are welcome, Ico. Regarding your question, on paper, the Windows sandbox should be a notch or two harder to break than Sandboxie but the reality is that the Windows sandbox is not a ready yet program, and Sandboxie is tougher to break than anything that actually works well that's out there. In all the years I used Sandboxie, I never had any malware break out of the sandbox, and what I am going to tell you next is even more powerful than that, I never heard of any real malware out in the wild escaping the sandbox infecting Sandboxie users. None, ever.

Sandboxies main protection is the sandbox. The role of the sandbox is to contain and isolate all activities that are carried on by programs that run in the sandbox. What programs do in the sandbox (changes), stays in the sandbox, sandboxed programs can not touch your system, registry, files or other programs. When you finish doing what you doing with the sandbox, you delete contents (automatically or manually).

The protection of the sandbox is more than plenty. But Sandboxie gives you more, if you want more.

I am going to use Open Office for an example of what you can do with Sandboxie, and how you can make things tougher for malware to break out of the sandbox.

Sandboxie has settings for you to setup a dedicated sandbox for OpenOffice where only OpenOffice programs will be allowed to run. If anything other than this programs attempt to run, they will be blocked from running. Also, since OpenOffice dont need to access the internet to work properly, you can setup your OO sandbox so no programs can connect to the internet. No internet means, programs in the sandbox cant steal your files and phone home. If you run your computer as an Administrator (as I do), Sandboxie has a Drop rights setting that strips programs that run in the sandbox of administrative rights.

One restriction on top of he other and all on top of the sandbox makes things very tough for malware to break out of the sandbox. Most of the time malware inside the sandbox wont even do anything, not even attempt to run.This restriction makes it more difficult for the malware to succeed in every step it takes to infect. By using the restrictions, malware will likely fail somewhere along the road.

Sandboxie also gives you settings for you to block programs that run in the sandbox from accessing your personal and sensitive files. This settings are important for protecting your sensitive files from being stolen.

Give Sandboxie a try. I ll give you a hand if you need one.

Bo

You can also use a VM to run these tests.
You can use Microsoft's own Hypervisor if you have Win 10 Pro or use the free Virtualbox. You can create multiple OS's across multiple platforms and test till your silly! It's safe and secure. Each Virtual Machine will keep the settings you used in the last session open or you can simply delete the VM and start over.